What does a VPN actually change about your IP?
Your device has a public IP address assigned by your internet provider. Every site you visit sees it, because it is the return address your traffic is sent back to. It is tied to your account with the ISP, and it usually maps to a rough geographic area — a city or region, not a street.
When you connect to a VPN, your traffic is encrypted and sent to the provider’s server first. That server makes the request on your behalf and sends the reply back down the tunnel. The website sees the server’s IP address, not yours. That substitution is the whole mechanism, and it is real: the address a site logs genuinely changes.
On almost every consumer VPN you are sharing that server address with hundreds of other subscribers at the same time. A shared IP is a feature rather than a limitation here — your activity is mixed in with everyone else on the same server, so the address on its own points at a crowd rather than at you. A dedicated IP, which some providers sell as an add-on, reverses that: it is yours alone, which helps with services that block shared addresses but removes the crowd you were hiding in.
The substitution is complete only for traffic that goes through the tunnel. That is the important qualifier, and most of the ways people end up exposing their real address come down to some traffic taking a different route — a lookup sent to the wrong resolver, an IPv6 request the client did not catch, or an app deliberately excluded through split tunnelling. The address change is genuine; whether it covers everything depends on the client closing every path, not just the main one.
Does a VPN change your location, or just look like it?
Location on the internet is inferred from your IP address. There is no satellite involved for a desktop browser; a site looks your address up in a database that maps address ranges to places. Change the address and you change what that database returns, which is why picking a server in another country makes sites treat you as being there.
The catch is that the server may not be where the label says. The industry sells virtual server locations: an address registered to one country running on hardware physically somewhere else. This is why country counts are not comparable between providers and should not be read as a quality score. Proton VPN, for example, states 148 countries across 191 locations, and says plainly that industry counts include virtual locations so they cannot be compared like for like.
The same counting problem shows up as internal contradictions. NordVPN’s own pages give figures ranging from 118 to 167 depending on where you look, because the count includes virtual locations. FastestVPN advertises 50+ countries in its FAQ but 49+ on its own server-locations page. None of this means the location change fails — it means the label on a location is a marketing figure, not a guarantee that a server sits on that country’s soil.
For most purposes this does not matter. If you want to appear in Germany, a German virtual location served from nearby hardware appears in Germany to every site that checks. It matters when latency matters, because a “Brazil” server physically in Miami behaves like Miami, and when you specifically need to be inside a country’s network rather than merely appear to be.
Why do some sites still block you after your IP changes?
Changing your IP to another country is not the same as convincing a service you belong there. Streaming platforms, banks and ticketing sites run vpn-detection, and the most reliable signal they use is not your location at all — it is that your address belongs to a datacentre rather than a residential ISP. VPN servers live in datacentres by definition, so their address ranges are published, catalogued and easy to flag in bulk.
This is where a shared IP works against you. When hundreds of subscribers leave a single server address at once, a service sees an implausible number of accounts arriving from one IP and treats it as automated traffic. The same address that hides you in a crowd also marks you as part of one. It is why a working geo-blocking bypass one week fails the next: the provider rotates to fresh address ranges, the service catalogues them, and the two sides trade moves continuously.
That churn is also why this site will not claim a named service works with a named provider. Blocking status changes weekly, so a promise made today is a liability by next month. A VPN reliably changes what your IP reports; whether a particular service accepts that is a moving target no honest review can pin down in advance.
What still gives away your location after your IP changes?
A changed IP is one signal among many, and it is the easiest one to override. Services that care about where you are do not rely on it alone, and the moment you sign in to an account you hand them better signals than an address.
The most common ones are entirely independent of your IP: the region set on your account, the country attached to your payment method, your browser’s locale and language headers, and your device’s timezone. A store that sees a German IP, a US account, a US card and a browser sending en-US requests will trust the three consistent signals over the one that changed.
On a phone there is a stronger tell still. Mobile operating systems can report GPS location directly to apps that have permission, and that has nothing to do with your IP. An app with location access knows where the handset physically is regardless of which VPN server it is routing through. Changing your IP does not touch it.
- Account region — the country you set when you registered, stored server-side
- Payment country — the billing address and card issuer attached to your subscription
- Browser locale and Accept-Language headers — sent with every request
- Device timezone — readable by any script in the page
- GPS and Wi-Fi positioning on mobile — reported to apps with location permission, independent of the tunnel
Can your real IP leak while the VPN is on?
Yes, in three specific ways, and each has a different cause. A working tunnel can still expose your real address at the edges if the client is not handling every path traffic can take. This is worth testing rather than assuming, because leaks have been reintroduced by client updates before.
A DNS leak is the most common. Your device asks a resolver which address a domain lives at before it connects. If that lookup goes to your ISP’s resolver instead of the provider’s, your ISP cannot read your encrypted traffic but it has the full list of every domain you asked about — which is usually enough to reconstruct where you have been. The address changed; the record of your browsing did not.
An IPv6 leak happens when your connection has IPv6 but the tunnel carries only IPv4. IPv6-capable sites then see your real IPv6 address directly, straight past the tunnel. The fix is for the provider to carry IPv6 inside the tunnel or for the client to block it at the interface; a leak test reporting an IPv6 address while connected means neither is happening.
WebRTC is the one that is most often described wrongly, including in an earlier version of this site that we corrected. Under a full tunnel the browser’s WebRTC connectivity check goes through the tunnel like everything else, so it does not leak your real address. It leaks only where split tunnelling or an IPv6 path already provides a route around the tunnel. In other words, WebRTC is not a VPN failure in itself — it exposes a gap that another misconfiguration has already opened.
Avoid
- Assuming an address change means DNS, IPv6 and WebRTC are all handled — they are separate paths
- Trusting a “WebRTC leak test” as proof your VPN is broken; under a full tunnel there is nothing for it to leak
- Testing once at install and never again after a client or OS update
So does a VPN hide your IP, and from whom?
It hides your IP from the sites and services you connect to, and it hides your browsing destinations from your ISP or local network operator. Those are two different observers, and the VPN moves you away from both by design. Your network operator sees an encrypted connection to a single VPN server and nothing about where it goes next; the websites you reach see the server’s address instead of yours.
What it does not do is hide your IP from the VPN provider itself. Your real address is where the tunnel starts — the provider necessarily receives it to send replies back to you. This is why a VPN relocates trust rather than removing it, and why the provider’s logging policy, jurisdiction and audit history are the whole decision. A no-logs claim is a statement about what the provider does with the address it can see, not a claim that it cannot see it.
That is also why audit evidence carries so much weight. PureVPN’s 2023 KPMG assessment found origin IP addresses sitting in the error logs of failed connections for users on manual configurations — a concrete example of a real address surfacing where a no-logs policy said it would not, caught only because the audit had the access to look. The address was being hidden from websites and the ISP the whole time; the exposure was on the provider’s own side, which is the side an audit exists to check.
The stronger the audit record, the more confidence the no-logs claim earns, because the provider can see your address and the only external check on what it keeps is someone examining the systems. Proton VPN has published five consecutive annual no-logs audits by Securitum through May 2026; NordVPN has run six assurance engagements since 2018, the last four by Deloitte under the ISAE 3000 assurance standard rather than an informal review. A single old report says less: FastestVPN has one audit, from January 2023, never repeated. None of these change what a VPN does to your IP — they change how much you should trust the party that still holds it.
What a changed IP does not do for you
A VPN changes your address and your apparent location. It does not make you anonymous, and treating those as the same thing is the mistake that undoes most of the value.
It does not hide you from services you log into. The moment you sign in, the address you arrived from is the least identifying thing about the session — your account is you, regardless of which country the connection appears to come from. It does not change your location for those logged-in accounts either: the account region and payment country stay put while only the IP moves.
It does not stop tracking by cookies, advertising identifiers or browser fingerprinting, because those operate above the network and follow you across IP changes. It does not remove a phone’s GPS location from apps that have permission. And it does not protect against malware, phishing or a compromised device. If the reason you want to hide your IP is to become untraceable, a VPN is one layer of that and not the whole of it — the honest version is that it changes who can watch your connection, not whether you can be identified.